Skills/npm/cli

cli@3.76.1

CAUTION· install only

Publisher claims: "Ruflo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher claude-flow · publishing for 312 daysInstalls 433KLast detonated 40 h ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-12 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Auto-update or dynamic fetch configuration; Auto-update or dynamic fetch configuration; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.1sprocessscript backend runs setup only
0.1sprocessscript backend runs setup only
0.1sprocesssecond launch, clock +45 days, CI unset

Static findings

HIGH
Auto-update or dynamic fetch configurationdist/src/index.js:514 · Auto-update or dynamic fetch configuration — agent may load new code at runtimethis.output.writeln(this.output.dim(`Updates available: ${nonAutoUpdates.map(u => `${u.package}@${u.latestVersion}`).join(', ')}`));Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationdist/src/update/index.js:26 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeautoUpdate: { ...DEFAULT_CONFIG.autoUpdate, patch: autoUpdate },Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/src/init/executor.js:1622 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'.env.*.local',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagebin/cli.js:8 · npx invocation of non-well-known package — may execute untrusted code* This allows: echo '{"jsonrpc":"2.0",...}' | npx @claude-flow/cliFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/cli.js:146 · npx invocation of non-well-known package — may execute untrusted code// 2. stdin is being piped AND args are "mcp start" (explicit, e.g. npx claude-flow@alpha mcp start)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Credential pass-through configurationdist/src/proxy/paths.js:33 · Credential pass-through configuration — agent relays sensitive credentialsexport function proxyTokenPath() {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
npx invocation of non-well-known packagedist/src/commands/eject.js:95 · npx invocation of non-well-known package — may execute untrusted code{ command: 'npx ruflo eject --name my-harness', description: 'Dry-run; prints what would happen' },Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationdist/src/update/index.js:23 · Auto-update or dynamic fetch configuration — agent may load new code at runtime: options.autoUpdate === true;Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/commands/eject.js:11 · npx invocation of non-well-known package — may execute untrusted code* npx ruflo eject --name my-harness --target /abs/out --confirmFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationdist/src/update/index.js:49 · Auto-update or dynamic fetch configuration — agent may load new code at runtime// Auto-update if enabledFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/cli.js:123 · npx invocation of non-well-known package — may execute untrusted code// under common timeout windows (npx default, MCP stdio 30 s). ResolveFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Credential pass-through configurationdist/src/proxy/paths.d.ts:16 · Credential pass-through configuration — agent relays sensitive credentialsexport declare function proxyTokenPath(): string;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
npx invocation of non-well-known packagedist/src/commands/eject.js:10 · npx invocation of non-well-known package — may execute untrusted code* npx ruflo eject --name my-harness --confirm # actually ejectFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/commands/eject.js:9 · npx invocation of non-well-known package — may execute untrusted code* npx ruflo eject --name my-harness # dry-run planFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/commands/eject.js:97 · npx invocation of non-well-known package — may execute untrusted codecommand: 'npx ruflo eject --name my-harness --confirm',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/src/init/executor.js:1621 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'.env.local',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Auto-update or dynamic fetch configurationdist/src/update/index.js:30 · Auto-update or dynamic fetch configuration — agent may load new code at runtime* Run auto-update check on startupFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationdist/src/update/index.js:21 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeconst autoUpdate = options.autoUpdate === undefinedFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/cli.js:90 · npx invocation of non-well-known package — may execute untrusted code' - Or pre-download: npx agentdb',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/src/init/executor.js:1620 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'.env',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/src/commands/init.js:236 · npx invocation of non-well-known package — may execute untrusted code// #2777 — earlier versions shelled out to `npx --yes skills add ruvnet/rufloFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/commands/init.js:162 · npx invocation of non-well-known package — may execute untrusted code// Keep Codex out of the CLI dependency graph so cold `npx ruflo --version`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/commands/init.js:255 · npx invocation of non-well-known package — may execute untrusted code…w\` (umbrella), and \`@claude-flow/cli\` (implementation). Users invoke it as \`npx ruflo <command>\`. ## When to invoke ruflo Suggest ruflo when the task involves any…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/commands/mcp.js:298 · npx invocation of non-well-known package — may execute untrusted code// pre-fix code from the user's npx cache.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/src/init/executor.js:2165 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file* Write CLAUDE.md with swarm guidanceFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packagedist/src/commands/init.js:234 · npx invocation of non-well-known package — may execute untrusted code// can run `npx skills add ruvnet/ruflo --all` themselves.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/commands/tui.js:13 · npx invocation of non-well-known package — may execute untrusted code* npx ruflo tui --view swarm # start on the Swarm page (keys 1-6 or o c s e m a switch pages)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/src/mcp-server.js:409 · Process kill command — agent can terminate processes// Force kill if still runningFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/src/init/executor.js:416 · npx invocation of non-well-known package — may execute untrusted code// #2448 — Detect and REGENERATE the runaway `npx @claude-flow/cli@latest`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/src/commands/mcp.js:127 · Process kill command — agent can terminate processesdescription: 'Force restart (kill existing server first)',Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/src/mcp-server.js:1052 · Process kill command — agent can terminate processes* `kill -0`, and isProcessRunning()'s process-name check on top of it, onlyFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/src/commands/hooks.js:2856 · npx invocation of non-well-known package — may execute untrusted code'nyc: npx nyc npm test',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/commands/hooks.js:3045 · npx invocation of non-well-known package — may execute untrusted code'Jest: npx jest --coverage',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/log-filters.js:70 · npx invocation of non-well-known package — may execute untrusted code' - Or pre-download: npx agentdb', // line 56Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/commands/tui.js:14 · npx invocation of non-well-known package — may execute untrusted code* npx ruflo tui --plain | head # one plain frame, exit 0 (scripts, CI)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
MCP server using network transport (SSE/HTTP)dist/src/commands/mcp.js:11 · MCP server using network transport (SSE/HTTP) — data sent over network…dog } from '../runtime/parent-death-watchdog.js'; import { getServerManager, getMCPServerStatus, resolveMcpHttpAuthToken, ensureDefaultMcpToken, isUnauthenticatedHttpAllowed, isLoopbackHost, filterAdvertisedMcpTools, parseMcpToolSelection,…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File permission modification commanddist/src/fs-secure.d.ts:10 · File permission modification command — agent changes file ownership/permissions* chmod fails silently on Windows, where POSIX modes don't apply — that'sFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packagedist/src/commands/hooks.js:2854 · npx invocation of non-well-known package — may execute untrusted code'Jest: npx jest --coverage',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/src/mcp-server.js:1115 · Process kill command — agent can terminate processes* Plain `kill -0` returns true for any process with the same owner,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actiondist/src/commands/hooks.js:2860 · File type combined with upload action — agent may exfiltrate local data filesoutput.writeln(output.dim('Expected files: coverage/coverage-summary.json, coverage/lcov.info, coverage/coverage-final.json, or .nyc_output/out.json'));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/src/commands/hooks.js:2855 · npx invocation of non-well-known package — may execute untrusted code'Vitest: npx vitest --coverage',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commanddist/src/fs-secure.js:10 · File permission modification command — agent changes file ownership/permissions* chmod fails silently on Windows, where POSIX modes don't apply — that'sFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commanddist/src/commands/mcp.js:231 · Process kill command — agent can terminate processes// Force kill the existing processFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/src/commands/tui.js:15 · npx invocation of non-well-known package — may execute untrusted code* npx ruflo tui | cat # not a terminal and no --plain: a hint on stderr, exit 2Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/init/executor.js:424 · npx invocation of non-well-known package — may execute untrusted code// Matches any invocation of `claude-flow hooks statusline` — either via npxFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/commands/tui.js:11 · npx invocation of non-well-known package — may execute untrusted code* npx ruflo tui # interactive, in a terminal (mouse on: click a page in the bar, scroll with the wheel)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/init/executor.js:256 · npx invocation of non-well-known package — may execute untrusted code// optionalDependency of the CLI and lands in the npx cache — unreachableFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/src/mcp-server.js:1152 · Process kill command — agent can terminate processes// If we can't inspect the process (macOS, Windows, permissions), fall back to kill checkFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/src/commands/mcp.js:140 · Process kill command — agent can terminate processes{ command: 'claude-flow mcp start -f', description: 'Force restart (kill existing)' }Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/src/init/executor.js:2194 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file// Also write/append global ~/.claude/CLAUDE.md so ruflo tools are used automatically (#1497).Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Process kill commanddist/src/mcp-server.js:1147 · Process kill command — agent can terminate processesreturn true; // Can't inspect, fall back to kill checkFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actiondist/src/commands/hooks.js:3051 · File type combined with upload action — agent may exfiltrate local data filesoutput.writeln(output.dim('Expected files: coverage/coverage-summary.json, coverage/lcov.info, coverage/coverage-final.json, or .nyc_output/out.json'));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commanddist/src/mcp-server.d.ts:244 · Process kill command — agent can terminate processes* Plain `kill -0` returns true for any process with the same owner,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/src/commands/init.js:274 · npx invocation of non-well-known package — may execute untrusted codenpx ruflo initFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/commands/hooks.js:2857 · npx invocation of non-well-known package — may execute untrusted code'c8: npx c8 npm test',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/init/executor.js:448 · npx invocation of non-well-known package — may execute untrusted code// use the runaway `npx @claude-flow/cli@latest hooks <sub>` form. These fireFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/init/executor.js:425 · npx invocation of non-well-known package — may execute untrusted code// (`npx [--prefer-offline] [@]claude-flow[/cli][@<tag>] hooks statusline …`)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/commands/tui.js:12 · npx invocation of non-well-known package — may execute untrusted code* npx ruflo tui --no-mouse # keyboard only, if SGR mouse reporting fights your terminal's text selectionFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/src/mcp-server.d.ts:225 · Process kill command — agent can terminate processes* `kill -0`, and isProcessRunning()'s process-name check on top of it, onlyFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actiondist/src/commands/hooks.js:3271 · File type combined with upload action — agent may exfiltrate local data filesoutput.writeln(output.dim('Expected files: coverage/coverage-summary.json, coverage/lcov.info, coverage/coverage-final.json, or .nyc_output/out.json'));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈65 tok
1 file · 81 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for @claude-flow/cli@3.76.1 as of 39 h ago. This is the package itself, not its dependencies.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim claude-flow: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Credential pass-through configuration≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
  6. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim claude-flowPropose a patch to the maintainer